Your logs are native, and hard to follow. I've trimmed it down a bit, and sorted by session to make it easier to follow.
It looks like info is being spoofed by a yahoo user. The bounces are just part of the problem with senders not being verified. I'm not sure what you can do about it, SPF ain't quite ready for prime-time. Interesting message later, session 310a, 522 VS15-BT5 Mailbox bounce quota exceeded. hth Dan 5553 SD (479d) [69.49.xxx.xxx] EHLO school.org 5553 SD (479d) [69.49.xxx.xxx] MAIL FROM: <[EMAIL PROTECTED]> 5554 SD (479d) [69.49.xxx.xxx] RCPT TO: <[EMAIL PROTECTED]> 5600 SD (479d) [69.49.xxx.xxx] C:\IMail\spool\D479d.SMD 24842 5600 SD (479d) performing antispamchecks 5601 S (479d) processing C:\IMail\spool\Q479d.SMD 5601 S (479d) Creating message from Postmaster 5601 S (479d) finished C:\IMail\spool\Q479d.SMD status=2 5555 SD (479e) [69.49.xxx.xxx] connect 69.49.xxx.xxx port 54469 5555 SD (479e) [69.49.xxx.xxx] EHLO school.org 5556 SD (479e) [69.49.xxx.xxx] MAIL FROM: <[EMAIL PROTECTED]> 5556 SD (479e) [69.49.xxx.xxx] RCPT TO: <[EMAIL PROTECTED]> 5602 SD (479e) [69.49.xxx.xxx] C:\IMail\spool\D479e.SMD 24850 5602 SD (479e) performing antispam checks 5606 S (479e) processing C:\IMail\spool\Q479e.SMD 5606 S (479e) Creating message from Postmaster 5606 S (479e) finished C:\IMail\spool\Q479e.SMD status=2 5601 SD (47a0) [69.49.xxx.xxx] connect 69.49.xxx.xxx port 4690 5601 SD (47a0) [69.49.xxx.xxx] HELO sith.axixxxx.net 5601 SD (47a0) [69.49.xxx.xxx] MAIL FROM: <[EMAIL PROTECTED]> 5601 SD (47a0) [69.49.xxx.xxx] RCPT TO: <[EMAIL PROTECTED]> 5601 S (0000) Info - Adding Queue file C:\IMail\spool\Q479d.SMD 5601 S (0000) Info - Adding Queue file C:\IMail\spool\Q1d53.GSE 5606 S (0000) Info - Adding Queue file C:\IMail\spool\Q479e.SMD 5606 S (0000) Info - Adding Queue file C:\IMail\spool\Q310a.GSE 5601 S (1d53) processing C:\IMail\spool\Q1d53.GSE 5601 S (1d53) ldeliver mail.school.org prdirector-main (1) 435 5601 S (1d53) finished C:\IMail\spool\Q1d53.GSE status=1 5603 SD (47a2) [69.49.xxx.xxx] connect 69.49.xxx.xxx port 4717 5606 S (310a) processing C:\IMail\spool\Qda8600000d24310a.GSE 5606 S (310a) [x] looking up yahoo.com in HOSTS and MX 5606 S (310a) Info - DNS Cache full, deleting last item (Fexxxx.org) 5606 S (310a) Info - Adding yahoo.com to DNS cache - TTL = 1228 5606 S (310a) Trying yahoo.com (0) 5606 S (310a) [x] Connecting socket to service <SMTP> on host <yahoo.com> using protocol <tcp> 5606 S (310a) [x] using source IP for sith.axixxxx.net [69.49.xxx.xxx] 5606 S (310a) Info - Found yahoo.com in DNS Cache 5609 S (310a) Connect yahoo.com [64.156.215.6:25] (1) 5610 S (310a) 220 YSmtp mta178.mail.scd.yahoo.com ESMTP service ready 5610 S (310a) >EHLO sith.axixxxx.net 5610 S (310a) 250-mta178.mail.scd.yahoo.com 5610 S (310a) 250-8BITMIME 5610 S (310a) 250-SIZE 31981568 5610 S (310a) 250 PIPELINING 5610 S (310a) >MAIL FROM:<> 5610 S (310a) 250 null sender <> ok 5610 S (310a) >RCPT To:<[EMAIL PROTECTED]> 5610 S (310a) 522 VS15-BT5 Mailbox bounce quota exceeded (#5.2.2 5610 S (310a) >QUIT 5610 SD (47a3) [69.49.xxx.xxx] connect 69.49.xxx.xxx port 54502 5610 SD (47a3) [69.49.xxx.xxx] EHLO school.org -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Chris Moody Sent: Tuesday, November 09, 2004 10:38 AM To: [EMAIL PROTECTED] Subject: [IMail Forum] No message body I have a user with a virtual domain that gets several return messages from the root account (postmaster) of the main domain on the server. These don't contain the original message, but rather the message: No message body: [EMAIL PROTECTED] Original message follows. That is it. No message. I've looked over the headers and the logs, but nothing is jumping out at me. I've changed the domains to protect the innocent. In this case school.org is a virtual domain on sith.axixxxx.net. Could someone take a look and see if they can make anything of it? Maybe this is something odd in Imail that I haven't found yet? It doesn't seem to affect anyone else, but this user is really vocal about this quirk. Any help is appreciated! Thanks! Date: Tue, 9 Nov 2004 09:56:01 -0500 Message-Id: <[EMAIL PROTECTED]> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii From: "Postmaster" <[EMAIL PROTECTED]> Sender: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: Undeliverable Mail X-Mailer: <SMTP32 v8.13> X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 399416336 <snip> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
